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Quantum computers are able to outperform classical algorithms. This was long recognized by 
the visionary Richard Feynman who pointed out in the 1980s that quantum mechanical problems 
were better solved with quantum machines. It was only in 1994 that Peter Shor came up with 
an algorithm that is able to calculate the prime factors of a large number vastly more efficiently 
than known possible with a classical computer [1]. This paradigmatic algorithm stimulated the 
flourishing research in quantum information processing and the quest for an actual implementation 
of a quantum computer. Over the last fifteen years, using skillful optimizations, several instances of 
a Shor algorithm have been implemented on various platforms and clearly proved the feasibility of 
quantum factoring I2HZ]- For general scalability, though, a different approach has to be pursued [S]. 

Here, we report the realization of a fully scalable Shor algorithm as proposed by Kitaev . For this, 
we demonstrate factoring the number fifteen by effectively employing and controlling seven qubits 
and four “cache-qubits”, together with the implementation of generalized arithmetic operations, 
known as modular multipliers. The scalable algorithm has been realized with an ion-trap quantum 
computer exhibiting success probabilities in excess of 90%. 

PACS numbers: 03.67.Lx, 37.10.Ty, 32.80.Qk 


Shor’s algorithm for factoring integers [T] is one of the 
examples where a quantum computer (QC) outperforms 
the most efficient known classical algorithms. Experi¬ 
mentally, its implementation is highly demanding as it 
requires both a sufficiently large quantum register and 
high-fidelity control. Clearly, such challenging require¬ 
ments raise the question whether optimizations and ex¬ 
perimental shortcuts are possible. While optimizations, 
especially system-specific or architectural, certainly are 
possible, for a demonstration of Shor’s algorithm to be 
scalable special care has to be taken not to oversimplify 
the implementation - for instance by employing knowl¬ 
edge about the solution prior to the actual experimental 
implementation - as pointed out in Ref. [Sj 

In order to elucidate the general task at hand, we first 
explain and exemplify Shor’s algorithm for factoring the 
number 15 in a (quantum) circuit model. Subsequently, 
we show how this circuit model is translated for and im¬ 
plemented with an ion-trap quantum computer. 

How does Shor’s algorithm work? Here is a classi¬ 
cal recipe to find the factors of a large number. As 
an example, assume the number we want to factor is 
N = 15. Then pick a random number a € [2,A^ — 1] 
(which we call the base in the following), say a = 7. 
Check if the greatest common divisor gcd(a, A^) = 1, 
otherwise a factor is already determined. This is the 
case for a = {3, 5, 6 ,9,10,12}. Next, calculate the modu¬ 
lar exponentiations mod N for x = 0,1, 2... and find 
its period r: the first x > 0 such that mod N = 1. 
Given the period r, finding the factors requires calcu¬ 
lating the greatest common divisors of ± 1 and N, 


which is classically efficiently possible - for instance us¬ 
ing Euclid’s algorithm. For our example {N = 15,a = 7) 
the modular exponentiation yields 1, 7, 4, 13, 1, ..., 
which has period 4. The greatest common divisor of 
a”/2 ± 1 = 74/2 ± 1 = {48,50} and = 15 are {3,5}, 
the non-trivial factors of N. For the chosen example 
N = 15, the cases a = {4,11,14} have periodicity r = 2 
and would only require a single multiplication step (a^ 
mod A^ = 1), which is considered an “easy” case [5]. Note 
that the periodicity for a chosen a can not be predicted. 

How can this recipe be implemented in a QC? A QC 
also has to calculate mod Al in a computational reg¬ 
ister for X = 0,1, 2... and then extract r. However, using 
the quantum Fourier-transform (QFT), this can be done 
with high probability in a single step (compared to r 
steps classically). Here, x is stored in a quantum reg¬ 
ister consisting of k qubits, or period-register, which is 
in a superposition of 0 to 2^ — 1. The superposition in 
the period-register on its own does not provide a speedup 
compared to a classical computer. Measuring the period- 
register would collapse the state and only return a sin¬ 
gle value, say xi, and the corresponding answer to 
mod N in the computational register. However, if the 
QFT is applied to the period-register, the period of 
mod N can be extracted from Oil) measurements. 

What are the requirements and challenges to imple¬ 
ment Shor’s algorithm? First, we focus on the period- 
register, to subsequently address modular exponentia¬ 
tion in the computational register. Factoring N, an 
n = |"log 2 (Al)]-bit number requires a minimum of n 
qubits in the computational register (to store the re- 
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FIG. 1: Circuit diagram of Shor’s algorithm for factoring 15 based on Kitaev’s approach for: a) a generic base a; and the 
specific circuit representations for the modular multipliers; b) The actual implementation for factoring 15 to base 11, optimised 
for the single input state it is subject to; c) Kitaev’s approach to Shor’s algorithm for the bases {2,7,8,13}: the optimised map 
of the first multiplier is identical in all 4 cases, the last multiplier is implemented with full modular multipliers as depicted in 
d); d) Circuit diagrams of the modular multipliers of the form a mod N for bases a={2,7,8,ll,13}. 


suits of mod N) and generally about 2n qubits in 
the period-register m- Thus even a seemingly simple 
example such as factoring 15 (an n = 4 -bit number), 
would require 3n = 12 qubits when implemented in this 
straightforward way. These qubits then would have to be 
manipulated with high fidelity gates. Given the current 
state-of-the-art control over quantum systems such 
an approach likely yields an unsatisfying performance. 
However, a full quantum implementation of this part 
of the algorithm is not really necessary. In Ref. [9] Ki- 
taev notes that, if only the classical information of the 
QFT (such as the period r) is of interest, 2n qubits sub¬ 
ject to a QFT can be replaced by a single qubit. This 
approach, however, requires qubit-recycling (specifically: 
in-sequence single-qubit readout and state reinitializa¬ 
tion) paired with feed-forward to compensate for the re¬ 
duced system size. 

In the following, Kitaev’s QFT will be referred to as 
KQFT*^^b It replaces a QFT acting on M qubits with 
a semiclassical QFT acting repeatedly on a single qubit. 
Similar applications of Kitaev’s approach to a semiclas¬ 
sical QFT in quantum algorithms have been investigated 
in Refs. [I2l - [l4] . For the implementation of Shor’s algo¬ 
rithm, Kitaev’s approach provides a reduction from the 
previous n computational qubits and 2n QFT qubits (in 
total 3n qubits) to only n computational-qubits and 1 
KQft(2 ") qubit (in total n + 1 qubits). 

A notably more challenging aspect than the QFT, and 
the second key-ingredient of Shor’s algorithm, is the mod¬ 


ular exponentiation, which admits these general simplifi¬ 
cations: 

(i) Considering Kitaev’s approach (see Fig. [^, the in¬ 
put state |1) (in decimal representation) is subject to a 
conditional multiplication based on the most-significant 
bit k of the period register. At most there will be two 
results after this first step. It follows that, for the very 
first step it is sufficient to implement an optimized oper¬ 
ation that conditionally maps |1) —>■ |a^ mod N). Con¬ 
sidering the importance of a high-fidelity multiplication 
(with its performance being fed-forward to all subsequent 
qubits), this efficient simplification improves the overall 
performance of experimental realizations. 

(ii) Subsequent multipliers can similarly be replaced 
with maps by considering only possible outputs of the 
previous multiplications. However, using such maps will 
become exponentially more challenging, as the number of 
input and output states to be considered grows exponen¬ 
tially with the number of steps: after n steps, 2” > 
possible outcomes need to be considered - a numerical 
task as challenging as factoring N by classical means. 
Thus, controlled full modular multipliers need to be im¬ 
plemented. Fig. shows the experimentally obtained 
truth table for the modular multiplier (2 mod 15) (see 
also supplementary material for modular multipliers with 
bases (7, 8,11,13}). These quantum circuits can be effi¬ 
ciently derived from classical procedures using a variety 
of standard techniques for reversible quantum arithmetic 
and local logic optimization [miis]. 
































































































































3 



FIG. 2: Experimentally obtained truth table of the controlled 2 modular 15 multiplier: a) with the control-qubit being in state 
0, the truth table corresponds to the identity operation; b) when the control qubit triggers the multiplication, the truth table 
illustrates the multiplication of the input state with 2 modular 15. 


(iii) The very last multiplier allows one more simplifi¬ 
cation: Considering that the actual results of the modu¬ 
lar exponentiation are not required for Shor’s algorithm 
(as only the period encoded in the period-register is of 
interest), the last multiplier only has to create the cor¬ 
rect amount of correlations between the period register 
and the computation register. Local operations after the 
conditional (entangling) operations may be discarded to 
facilitate the final multiplication without affecting the re¬ 
sults of the implementation. 

(iv) In rare cases, certain qubits are not subject to 
operations in the computation. Thus, these qubits can 
be removed from the algorithm entirely. 

For larger scale quantum computation, optimization 
steps (i), (iii) and (iv) will only marginally effect the 
performance of the implementation. They represent only 
a small subset of the entire computation which mainly 
consists of the full modular multipliers. Thus, the real¬ 
ization of these modular multipliers is a core requirement 
for scalable implementations of Shor’s algorithm. 

Furthermore, Kitaev’s approach requires in-sequence 
measurements, qubit-recycling to reset the measured 
qubit, feed-forward of gate settings based on previous 
measurement results, as well as numerous controlled 
quantum operations - tasks that have not been realized 
in a combined experiment so far. 

We demonstrate these techniques in our realization 
of Shor’s algorithm in an ion-trap quantum computer, 
with five "^°Ca+ ions in a linear Paul trap. The qubit 
is encoded in the ground state S'i/ 2 (w = —1/2) = |1) 
and the metastable state D^/ 2 {^ = —1/2) = |0). The 
universal set of quantum gates consists of the entan¬ 


gling Mplmer-Sprenson interaction ini, collective op¬ 
erations of the form exp(—with S^j, = ^ 

= COs((/)cri*^ -bsin((^)4*\ the Pauli operators 

of qubit i, 9 = fit determined by the Rabi frequency fl 
and laser pulse duration t, cj) determined by the relative 
phase between qubit and laser, and single qubit phase 
rotations induced by localized AC-Stark shifts (for more 
details see the supplementary material and Ref. [HD. Uni¬ 
tary operations illustrated in Fig. are decomposed into 
primitive components such as two-target C-NOT and C- 
SWAP gates (or gates with global symmetries such as the 
four-target C-NOT employed here), from which an adap¬ 
tation of the GRAPE algorithm m can efficiently derive 
an equivalent sequence of laser pulses acting on only the 
relevant qubits. The problem with this approach is that 
the resulting sequence generally includes operations act¬ 
ing on all qubits. Implementing the optimized 3-qubit 
operations on a 5-ion string therefore requires decoupling 
of the remaining qubits from the computation space. We 
spectroscopically decouple qubits by transferring any in¬ 
formation from \S) \D') = D^i 2 {m = —5/2) and 

\D) —>• 15") = «S'i/ 2 (m = 1/2). Here, the subspace 
{15"), \D')} serves as a readily available “quantum cache” 
to store and retrieve quantum information in order to fa¬ 
cilitate quantum computations. 

Finally, to complete the toolbox necessary for a Ki¬ 
taev’s approach to Shor’s algorithm, we also implement 
single qubit readout (by encoding all other qubits in 
the {\D), \D')} subspace and subsequent electron shelv¬ 
ing |5D] on the 5 i/2 ^ P 1/2 transition), feed-forward 
(by storing counts detected during the single-qubit read- 
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out m in a classical register and subsequent condi¬ 
tional laser pulses) and state-reinitialization (using opti¬ 
cal pumping for the ion, and Raman-cooling [22l [23] for 
the motional state of the ion string). The pulse sequences 
and additional information on the implementation on the 
modular multipliers are available as supplementary ma¬ 
terial. 

The key differences of our implementation with respect 
to previous realizations of Shor’s algorithm are: a) the en¬ 
tire quantum register is employed, without sparing qubits 
that don’t partake in the calculation; b) besides the triv¬ 
ial hrst multiplication step (corresponding to r = 2 for 
a = {4,11,14}, realized only once for a = 11), all non¬ 
trivial modular multipliers a = {2,7,8,13} have been 
realized and applied; and c) Kitaev’s originally proposed 
scheme is implemented with complete qubit recycling - 
doing both readout and reinitialization on the very same 
physical qubit. This is especially important for factor¬ 
ing 15 with base {2,7,8,13}, as at least two steps are 
required for the semiclassical QFT. In our realization we 
go beyond the minimal implementation of Shor’s algo¬ 
rithm and not only employ all 7 qubits (comprised of 4 
physical qubits in the computational register, 1 qubit in 
the periodicity register - recycled twice, plus additional 
cache qubits), but also include multiplication with up to 
the fourth power (although they correspond to the iden¬ 
tity operation). This represents a realistic attempt at a 
scalable implementation of Shor’s algorithm as the entire 
qubit register remains subject to decoherence processes 
along the computation, and no simplifications are em¬ 
ployed which presume prior knowledge of the solution. 

The measurement results for base a = {2,7,8,11,13} 
with periodicities r = {4,4,4, 2,4} are shown in Fig. 

In order to quantify the performance of the implementa¬ 
tion, previous realizations mainly focused on the squared 
statistical overlap (SSO) [24], the classical equivalent to 
the Uhlmann fidelity [10]. While we achieved an SSO 
of {0.968(1), 0.964(1), 0.966(1), 0.901(1), 0.972(1)} for 
the case of a={2,7,8,ll,13}, we argue that this does not 
answer the question of a user in front of the quantum 
computer: “What is the periodicity?” Shor’s algorithm 
allows one to deduce the periodicity with high probabil¬ 
ity from a single-shot measurement, since the output of 
the QFT is, in the exact case, a ratio of integers, where 
the denominator gives the desired periodicity. This peri¬ 
odicity is extracted using a continued fraction expansion, 
applied to x/2'^, a good approximation of the ideal case 
when fc, the number of qubits, is sufficiently large. For 
the realised examples, the probabilistic nature of Shor’s 
algorithm becomes clear: the output state 0 never yields 
any information. For periodicity 4 (and 3 qubits in the 
period-register), the output state 4 suggests a fraction 
^ thus a periodicity of 2 and also fails. For peri- 
docity 4, only the output states 2 and 6 allow one to de¬ 
duce the correct periodicity. In our realisations to bases 
a = {2,7,8,11,13}, the probabilities to obtain output 


Shor: 15 base 2 Shor: 15 base 7 Shor: 15 base 8 Shor: 15 base 11 Shot: 15 base 13 



FIG. 3: Results and correct order-assign probability for the 
different implementations to factor 15: a) 3-digit results (in 
decimal representation) of Shor’s algorithm for the different 
bases. The ideal data (red) for periodicity {2,4} is superim¬ 
posed on the raw data (blue). The squared statistical overlap 
is larger than 90% for all cases. 

states that allow the derivation of the correct periodic¬ 
ity are {56(2), 51(2), 54(2), 47(2), 50(2)}%. Thus, a con¬ 
fidence that the correct periodicity is obtained at a level 
of more than 99%, requires the experiment to run about 
8 times. 

In summary, we have presented the realization of Ki¬ 
taev’s vision to realize a scalable Shor’s algorithm with 
3-digit resolution to factor 15 using bases {2,7,8,11,13}. 
Here, a semiclassical QFT combined with single-qubit 
readout, feed-forward and qubit recycling was success¬ 
fully employed. Compared to the traditional algorithm, 
the required number of qubits can thus be reduced by 
almost a factor of 3. Furthermore, the entire quantum 
register has been subject to the computation in a “black¬ 
box” fashion. Employing the equivalent of a quantum 
cache by spectroscopic decoupling significantly facilitated 
the derivation of the necessary pulse sequences to achieve 
high-fidelity results. In the future, spectroscopic decou¬ 
pling might be replaced by physically moving the qubits 
from the computational zone using segmented traps [25j . 

Our investigations also reveal some open questions 
and problems for current and upcoming realizations of 
Shor’s algorithm, which also apply to several other large- 
scale quantum algorithms of interest: particularity, find¬ 
ing system-specific implementations of suitable pulse se¬ 
quences to realize the desired evolution. The presented 
operations were efficiently constructed from classical cir¬ 
cuits, and decomposed into manageable unitary building 
blocks (quantum gates) for which pulse sequences were 
obtained by an adapted GRAPE algorithm. Thus, the 
presented successful implementation in an ion-trap quan¬ 
tum computer demonstrates a viable approach to a scal¬ 
able Shor algorithm. 
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Supplementary Material 
Pulse sequences 

In the following, the pulse sequences employed in the 
experiment are discussed in more detail. The nomen¬ 
clature is as follows: The collective operations on the 
S'i/ 2 (to = —1 /2) -O' D 5 / 2 (m = —1/2) transitions, ad¬ 
dressing all ion-qubits, realize the unitary operation 

R{9, <j)) = exp(-i^6i5'0) 
with the collective spin operator 

= ^ = XI cos(</7r)crW + sin((/7r)crW 

i i 

based on the Pauli operators a)' „ acting on qubit 
qubit i. Here, the rotation angle 9 is defined hy 9 = ^ 
with the Rabi frequency H and the laser pulse duration 
t. In this notation, a bit flip around corresponds to 
i?(l,0). The collective operations are supplemented by 
single-qubit phase shifts of the form 

9tt 

S^{9,i) = exp(-i —crW). 

The phase shift is realized by illuminating a single qubit 
with a tightly focused laser beam detuned —20 MHz from 
the carrier transition. Here, the induced AC-Stark shift 
A^C implements the desired phase shift, with the rota¬ 
tion angle 9 = depending on the pulse duration 

t. In combination, collective operations and single-qubit 
phase shifts allow us to implement arbitrary local op¬ 
erations. A universal set of quantum gates, capable of 
implementing any desired unitary operation, can be real¬ 
ized by combining these arbitrary local operations with 
an entangling interaction. In our experiment, we employ 
the Mplmer-Sprensen (MS) interaction [T7] to realize en¬ 
tangling operations of the form 

MS{9)=eM-^l0Sl) 

with Sx = Y^ctx^. Using this notation, the maximally 
entangling MS{^) operation applied onto the A-qubit 
state |0 ... 0) directly creates the A-qubit GHZ state. 

Single-qubit measurement 

Electron-shelving [3D] on the S' 1/2 P 1/2 transition 

addresses, and thus projects, all qubits of the quantum 
register. For Kitaev’s implementation, however, only one 
qubit needs to be measured. With collective illumination, 
this can be achieved by transfering quantum information 
encoded in qubits that should not be measured into the 


H-state manifold. Here, the quantum information is pro¬ 
tected against shelving light on the S' 1/2 ^ P 1/2 transi¬ 
tion - the ion will not scatter any photons. Using light 
resonant with the Si/ 2 (to = —1/2) o Z? 5 / 2 (m. = —5/2) 
transition (denoted by R2{9, (/>)),& refocusing sequence of 
the form i?2(0.5,0) • Sz(l, *) •i?2(0.5,0) efficiently encodes 
all but qubit i in = —1/2) and = —5/2). 

Subsequently, the entire quantum register may be subject 
to shelving light, yet only qubit i will be projected. 


In-sequence detection and feed-forward 

When all qubits that need to be protected against 
projection have been encoded in the {I? 5 / 2 (™ = 

—1/2), Zl 5 / 2 (m = —5/2)} manifold, light at 397 nm res¬ 
onant with the Si /2 Pi 12 transition state-dependently 
scatters photons an the remaining ion-qubits. The illu¬ 
mination time is set to 300 /rs. A histogram of the photon 
counts detected at the photomultiplier tube is shown in 
Fig.i Using counter electronics with discriminator set at 
4 counts within the detection window, the state D with a 
mean count rate of 0.24 counts/ms (or 0.07 counts within 
the detection window) and state S with a mean coun- 
trate of 48 counts/ms (or 14.4 counts in the detection 
window) can be distinguished with a confidence better 
than 99.8%. The boolean output of the discriminator is 
subsequently used in the electronics for state-dependent 
pulses and thus state-dependent operations. 



Counts 


FIG. 4: In-sequence photon-count histogram: Using a de¬ 
tection window of 300 /rs, the photomultiplier tube collects 
on average 0.07 counts when the qubit is in state D and 
14.4 counts when it is in state S. As can be seen in the hgure, 
these two Poisson distributions are well distinguishable. 
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Recooling and Qubit-reset 

Scattering photons during the detection window heats 
the ion-string and can lower the quality of subsequent 
quantum operations applied to the register. Therefore 
recooling of the ion-string after the illumination with 
electron-shelving light is necessary. However, this recool¬ 
ing must not destroy any quantum information stored 
in the other qubits. Considering that the hidden quan¬ 
tum information is stored in the 7 ^ 5/2 manifold, we em¬ 
ploy 3-beam Raman-cooling [22l [23] in the 51/2 ^ -Pi /2 
manifold. The Raman light field, consisting of and 
TT light with respect to the quantization axis, is de¬ 
tuned by 1.5 GHz from the resonant 5 i /2 -O- P 1/2 tran¬ 
sition. The relative detuning between and tt is 
chosen such that it creates resonant coupling between 
Si/ 2 {m = — 1 / 2 ) ® |n) O Si/ 2 {m = 1 / 2 ) ® |n — 1 ), with 
\n) representing the quantized axial state of motion of the 
ion. The transfer is reset by resonant a~ light. Raman 
cooling is employed for 500 fis. The qubit is reinitialized 
after cooling by an additional 50 /iS of a~ light. However, 
if the measured qubit was found to be in state H, neither 
does the measurement heat the ion string nor does the 
Raman cooling affect the register. Therefore the qubit 
is transferred from D^/ 2 {m = — 1 / 2 ) to 5 i/ 2 (m = 1 / 2 ) 
(which was depleted by the previous 50 /iS of a~). An 
additional pulse of a~ light for 50 /iS finally initializes 
the qubit, regardless whether it was projected into S or 
D. During the entire time when the qubit is subject to 
Raman cooling or initializing cr“ light, a repump laser at 
866 nm is applied to prevent population trapping in the 
D ^/2 manifold due to spontaneous decay from the P 1/2 
state to D 3 / 2 . 

Pulse sequence optimisation 

For a sufficiently large Hilbert-space it will no longer 
be possible to directly optimize unitary operations act¬ 
ing on the entire register. Decomposing the necessary 
unitary operations into building blocks acting on smaller 
register sizes will allow one the use of optimized pulse 
sequences for large-scale quantum computation. From 
a methodological point of view it may be preferred to 
physically decouple the qubits from any interactions (for 
instance by splitting and moving part of ion-qubit quan¬ 
tum register out of an interaction region, such as pro¬ 
posed in Ref. ESI). However, given the technical re¬ 
quirements and challenges for splitting and moving ion- 
strings, we focus on spectroscopically decoupling certain 
ion-qubits from the interaction. In particular, we spec¬ 
troscopically decouple an ion from subsequent interac¬ 
tion by transferring any quantum information from the 
{ 5 i/ 2 (m = — 1 / 2 ), D 5 / 2 (m = — 1 / 2 )} manifold to the 
{Si/ 2 {m = l/ 2 ),Zl 5 / 2 (m = —5/2)} manifold using refo¬ 
cusing techniques on the 115/2 (m = — 1 / 2 ) o 5 i/ 2 (to = 


1/2) and 5 i/ 2 (to = —1/2) o D^j 2 {m = —5/2) transi¬ 
tions. Using this approach, we optimise the controlled 
swap operation in a 3-qubit Hilbert space rather than a 
5-qubit Hilbert space. 


Controlled-SWAP 

The controlled-SWAP operation, also known as Fred- 
kin operation, plays a crucial role in the modular multi¬ 
plication. For its implementation, however, we could not 
derive a pulse sequence that can incorporate an arbitrary 
number of spectator qubits — qubits, that should be sub¬ 
ject to the identity operation — in the presented case, i.e. 
2 spectator qubits in the computational register. How¬ 
ever, using decoupling of spectator qubits, this additional 
requirement on the implementation is not necessary. Us¬ 
ing pulse sequence optimization |19] . we obtained a se¬ 
quence for the exact three-qubit case as shown in Tab. [l| 
In total the sequence consists of 18 pulses, including 4 
MS interactions. 


Pulse Nr. 

Pulse 

Pulse Nr. 

Pulse 

1 

A(l/2,l/2) 

10 

R(l/2,1) 

2 

5,(3/2,3) 

11 

5z(l/4,2) 

3 

M5(4/8) 

12 

S',(3/2,3) 

4 

5.(3/2,2) 

13 

MS'(4/8) 

5 

5.(l/2,3) 

14 

S',(3/2,2) 

6 

R(3/4,0) 

15 

5'z(3/2,l) 

7 

MS(6/8) 

16 

R(l/2,1) 

8 

5,(3/2,2) 

17 

5z(3/2,l) 

9 

M5(4/8) 

18 

543 / 2 , 2 ) 


TABLE I: Controlled SWAP operation: In a system of three 
ion-qubits, qubit 1 represents the control qubit and qubits 
{2,3} are to be swapped depending on the state of the first 
qubit. Note that this sequence only works for three-qubit 
systems. Spectator qubits would not experience the identity 
operation. 


Four-Target Controlled-NOT 

The modular multipliers (7 mod 15) and (13 
mod 15) require, besides Fredkin operations, also CNOT 
operations acting on all qubits in the computational 
register. Such an operation can be implemented (see 
Ref. EH (p.90, eq. 5.21) ) with 2 MS operations plus 
local operations only - regardless of the size of the 
computational register. The respective sequence is 
shown in Tab. El 








Pulse Nr. 

Pulse 

Pulse Nr. 

Pulse 

1 

Ril/2,1) 

6 

MS'(l/4) 

2 

5. (3/2,1) 

7 

E(3/4,0) 

3 

MS{3/4:) 

8 

5. (3/2,1) 

4 

R{5/4,1) 

9 

R{l/2,0) 

5 

5 .( 1 , 1 ) 




TABLE II: Four-target controlled NOT: Depending on the 
state of qubit one, the remaining four qubits {2-5} are subject 
to a conditional NOT operation. 

Two-Target Controlled-NOT 

There exists an analytic solution to realize multi-target 
controlled-NOT operations in the presence of spectator 
qubits with the presented set of gates [26] - as required for 
the {2,7,8,13}^ mod 15 multiplier. However, we find 
that performing decoupling of subsets of qubits of the 
quantum register prior to the application of the multi¬ 
target controlled-NOT operation presented above both 
facilitates the optimisation, and improves the perfor¬ 
mance of the realisation of a two-target controlled-NOT 
operation. Thus, the required two-target controlled-NOT 
operation is implemented via (i) decoupling qubits 2 and 
4, (ii) performing a multi-target controlled-not on all 
qubits with the first qubit acting as control, and (hi) 
recoupling of qubits 2 and 4. 


Controlled Quantum Modular Multipliers 

Based on the decomposition shown in Fig. and 
the respective pulse sequences outlined in the previous 
section, we investigate the performance of the building 
blocks as well as the respective conditional multipliers. 
In the following, the fidelities are defined as mean prob¬ 
abilities and standard deviations to observe the correct 
output state. The elements in the respective truth tables 
have been obtained as average over 200 repetitions. 

• The Fredkin operation, controlled by qubit 1 and 
acting on qubits {35,23,34,45}, yields hdelities of 
{76(4), 73(6), 72(4), 68(7)}%. These numbers are 
consistent with MS gate interactions at a fidelity 
of about 95% acting on three ions (in the presence 
of two decoupled ions) and local operations at a 
hdelity of 99.3%. 

• The 4-target CNOT gate operates at a fidelity of 
86(3)%. 

• Considering the quality for modular multipliers 
of ({2,4,7,8,11,13} mod 15), we find fidelities 
of (48(5), 40(5), 50(6), 46(5), 38(5)}%. This per¬ 
formance is consistent with the multiplication of 
the performance of the individual building blocks: 
{37(6), 36(5), 37(6), 48(5), 36(5)}%. 
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FIG. 5: Controlled modular multipliers: While the full truth tables have been obtained, for improved visibility only the subset 
of data for the computational register (in decimal basis) is presented for modular multipliers ({2,7,8,11,13} mod 15) where 
the control bit maps from |0) to |0) (a,c,e,g,i) as well as when |1) maps onto |1) (b,d,f,h,j). When the control qubit is in state 
|0), one expects to find the identity operation implemented, as shown in (a,c,e,g,i). If the control qubit is in state |1), the input 
state gets multiplied by ({2,7,8,11,13}) mod 15. This behaviour is visually demonstrated as the output state increases in 
steps of {2, 7,8,11,13} until it reaches 15, where the output is then returned to its value modulo 15. 






































































































































































































































































































































































